# What is vendor lock-in for secrets? > Vendor lock-in is when leaving a tool costs more than staying. What locks a team into a secrets manager, and the exit questions to ask before you move in. URL: https://crunu.com/learn/vendor-lock-in Language: en Updated: 2026-10-30 Vendor lock-in is the situation in which moving away from a product would cost so much time, money or risk that a team stays even when the product no longer suits it, because its data, workflows or integrations depend on that one vendor. ## What locks you into a secrets manager Secrets are small, so the values themselves are rarely the problem. A few hundred `KEY=VALUE` lines export in minutes. The lock-in sits around them: - **Integrations.** Every pipeline, server and app that fetches values through the vendor's API, CLI or SDK has to change. - **Server-side features.** Dynamic database credentials, automatic syncs into hosting platforms and rotation run by the vendor have no equivalent in a tool that works differently. - **Access structure.** Roles, groups, policies and their history, which rarely export in a form another product reads. - **History and audit.** Old versions and the audit log, which compliance may require you to keep after you leave. - **Hosting.** A service only the vendor can run, or a self-hosted product that only runs on one platform. - **The vendor leaving first.** Products get discontinued. HCP Vault Secrets reached end of life on July 1, 2026, or earlier at the end of a customer's contract ([IBM](https://www.ibm.com/support/pages/hcp-vault-secrets-end-life)), and EnvKey Cloud shut down on February 1, 2025 ([EnvKey README](https://github.com/envkey/envkey)). Their users moved on someone else's schedule. ## Exit questions to ask before moving in 1. Can I export every value, in a format I can read without the product? 2. Can I export the history and the audit log? 3. What breaks in my pipelines and servers if the product disappears tomorrow? 4. Where can it run, and can I move it myself? 5. Can I still read my data if the vendor's service is down? ## Common mistakes - **Testing only the import.** Every vendor makes it easy to come in. - **Spreading the vendor's SDK through your code,** instead of injecting values at start time. - **Ignoring the people side.** A migration also means new accounts and new habits for everyone. ## How Crunu answers the exit questions Being direct about both sides: - **Values leave in their own formats.** An environment holds files: `.env`, INI, flat YAML or text. You can download them, write them with `crunu pull`, or export an environment to an Ansible Vault file that `ansible-vault view` opens. - **Reading without the server.** The **offline copy** puts every environment you can access, except network-restricted ones, into one encrypted file that opens with your password and Secret Key, without any server. - **Moving the server.** A self-hosted server, available on the Enterprise plan, moves between Docker, Cloudflare Workers, Vercel and Google Cloud Run with one archive, `crunu-server export` and `import`, history and audit log included. The server's address stays the same across a move. - **Integration surface.** Programs get values as environment variables through `crunu run`; there is no SDK in your code to remove. - **What it doesn't have.** No import from 1Password, HashiCorp Vault, Doppler or Infisical, beyond dropping in files. No dynamic secrets or syncs, so there is nothing of that kind to migrate away from either. Self-hosting options and their exits are compared in [self-hosted secrets manager: options and trade-offs](https://crunu.com/guides/self-hosting-a-secrets-vault). Moving off a discontinued product: [HCP Vault Secrets shutdown](https://crunu.com/blog/hcp-vault-secrets-shutdown-where-next) and [migrating from EnvKey](https://crunu.com/blog/migrate-from-envkey). ## Sources - [IBM Support: HCP Vault Secrets end of life](https://www.ibm.com/support/pages/hcp-vault-secrets-end-life), checked October 30, 2026. - [EnvKey README](https://github.com/envkey/envkey), checked October 30, 2026.